Ransomware :(

[mudcow007]

at around 13:00 today we got a ransomeware infection across the whole domain

its infected Mail servers, file servers...you name its done em all

i thought they were they were urban legends!

god knows how its got in, our domain is fucked though

[CaNsA]

Which variant?

https://www.extremetech.com/internet/203522-kaspersky-releases-coinvault-ransomware-decryption-keys-for-free

https://www.decryptcryptolocker.com/

[The Shaggy D.A.]

[CaNsA]

[P.addy]

dem backups.

various schools have been infected and I have lol'd

all have come from attachments and retards opening them.

[mudcow007]

tongue in cheek about the "didnt realise they existed.."

its absolutely infected everywhere...

[dydey90]

[ScaredyCat]

[Ste]

Would you like to buy some bitcoins then?

[mudcow007]

[duhawkz]

dat BCP
____________________
"The guy is a worthless cunt and I honestly believe I would be a slightly happier person if he died." - Chris-Red

[The Wobbly Orange]

I have had one before. It prevented any .exe file from being accessed. So I couldn't run the antivirus.

What I did was start up in safe mode, then did a system restore to before the virus was evident. That was a mere laptop though, I don't envy you.
____________________
People tell me I am lovely. How wrong they are!

[CaNsA]

[wots]

We had a customer with that, owed us money, told them we'd help for money owed plus a lot more. Restore from previous versions (shadow copies), in seconds.

Previous versions means I don't need to restore backups most of the time.
____________________
Currently: Yamaha DT 125 LC2,Repsol Fireblade, and Bumblebee MSX 125

[andys675]

last one I had there was an .exe for it in startup programs, so removed / disabled it from starting and let malwarebytes deal with it while in safe mode
____________________
Some people feel the rain, others just get wet.

[Ste]

[mudcow007]

all sorted - i hope

shadow copy was disabled by it

it had tried to block an modify McAfee AV, but didnt (as it was blocked) but McAfee didnt detect it

it was across both Macs & windows..

we ended up paying the ransom an getting sent the de-encrypt key

[CaNsA]

[Lone-Wolf]

[UncleFester]

Mcafee / Norton - might as well just welcome viruses and malware with open arms.
____________________
2017 Z1000SX

[mudcow007]

it was a "flavour" of cryptolocker, but the files that had become encrypted had a different message then the normal .txt

will find out what the text file was called tomorrow

have noticed a massive increase of spammy emails with full on dodgy attachments hitting out mailserver, i have ended up blocking word attachments!

[CaNsA]

[mudcow007]

yep i tried a few like [urlhttps://www.decryptcryptolocker.com/] this[/url] one but they just came up with

"your file is not encrypted with cryptolocker"

files that were infected, had there extensions changed to .exx

i think its something to do with

TeslaCrypt

[Ste]

https://github.com/vrtadmin/TeslaDecrypt

[CaNsA]